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This chapter surveys the use of analytical redundancy (AR) to improve 
turbine engine control system reliability. Since 1950, hydromechanical 
implementations of turbine engine control systems have matured into highly 
reliable units. However, as shown in Fig. 1, an increase in control 
complexity has occurred and is expected to continue. This increased 
complexity has made it difficult to build reliable, low-cost, lightweight 
hydromechanical controls. On the other hand, microprocessor-based digital 
electronic technology allows complex control systems to be built with low 
cost and weight. However, these digital electronic controls do not have the 
maturity and, therefore, the demonstrated reliability of hydromechanical 
engine control systems. 

Thus, in an effort to improve the overall demonstrated reliability of 
the digital electronic control system, various redundancy management 
techniques have been applied to both the total control system and to 
individual components. One of the least reliable of the control system 
components is the engine sensor. In particular, a study of fault-tolerant 
electronic engine controls 1 shows that sensor redundancy will be required to 
achieve adequate control system reliability. There are three types of 
sensor redundancy: direct, analytical, and temporal. Direct, or hardware, 

redundancy uses multiple sensors to measure the same engine variable. 
Typically, a voting scheme is used to detect failures. Analytical 
redundancy uses a reference model of the engine and redundant information in 
dissimilar sensors to provide an estimate of a measured variable. Estimates 
and measurements can be used in a variety of ways to detect failures. 


Temporal redundancy uses redundant information in successive samples of the 
output of a particular sensor to determine failures. Range and rate checks 
are simple and often used examples of temporal redundancy. 

Hardware redundancy is insensitive to failure magnitude since any 
detectable discrepancy between two like sensors indicates a failure. Thus, 
hardware redundancy handles hard (out-of-range or large in-range) failures 
as well as soft (small in-range or drift) failures. Analytically redundant 
schemes can distinguish failure type and, in fact, can be made sensitive to 
a particular type, such as soft failures. Range and rate checks are simple 
and reliable detection methods, but are limited to hard failures. Often 
range and rate checks are combined with analytical redundant schemes to 
cover both hard and soft failure types. As shown in Ref. 1, hardware 
redundancy results in more costly, heavier, less practical, and less 
reliable systems than do various analytical redundancy strategies. Since 
cost, weight, and reliability are important drivers in turbine engine 
control systems design, many researchers have investigated analytical 
redundancy strategies. 

State-of-the-art digital electronic control schemes, such as that for 
the PW 2037 engine, 2 make use of a combination of hardware and analytical 
redundancy to provide adequate system reliability. Here, dual-redundant 
sensor measurements and a synthesized or estimated measurement are compared 
to detect sensor failures. This approach is comparable to that used in the 
aircraft control for the F8 digital fly-by-wire aircraft. 2 In each case a 
two-step approach is used. First the dual sensors are compared to determine 
if a discrepancy exists. Then a comparison is made to the estimate to 
isolate the faulty sensor. Operation continues with the good sensor. Here 
analytical redundancy allows system operation after both sensors have failed 
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to further improve system reliability. Eventually, as AR-based techniques 
improve, additional reliance on AR strategies would allow single-sensor 
operation with the resultant savings in cost and weight. 

The objective of this chapter is to survey the application of 
analytical redundancy to the detection, isolation, and accommodation (DIA) 
of sensor failures for gas turbine engines. This includes those approaches 
that use software implementations of temporal redundancy combined with 
analytical redundancy. Hardware redundant strategies are not covered. This 
survey first reviews the theoretical and application papers which form the 
technology base of turbine engine analytical redundancy research. Second, 
the status of important ongoing application efforts is discussed. Also 
included is a review of the PW2037 engine control system sensor AR 
strategy. This is the first operational engine to include AR-based 
strategies. Finally, an analysis of this survey indicates some current 
technology needs. 

I. Analytical Redundancy Technology Base 

In this section, papers that document the AR technology base will be 
reviewed. Seventeen papers are considered. The papers will be reviewed in 
essentially chronological order. The attributes of each paper, as discussed 
in this section, are summarized in Table I. 

Wallhagen and Arpasi 4 presented the first (April 1974) use of sensor AR 
to improve engine control system reliability. A J85, single-spool, turbojet 
with two sensed variables and three controlled variables was tested at a 
sea-level-static condition. The inputs were compressor variable geometry, 
fuel flow, and exhaust nozzle area. The sensors were a magnetic pickup for 
rotor speed and a high-response gage transducer for compressor static 
discharge pressure. Failure detection was accomplished by comparing the 
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rate of change of the sensed variables with predetermined limits. Four 
consecutive out-of-range rates declared a failure. Since each sensor was 
tested for catastrophic, i.e., hard failure only, isolation is immediate. 
Failures are accommodated by replacement of the failed sensed value with a 
synthesized estimate. This synthesized variable is obtained from a 
tabulation of the synthesized variable as a function of the remaining engine 
variables. Different tables were stored for steady-state and acceleration 
conditions. No explicit dynamical relationships were included. The DIA 
logic was implemented in fixed-point assembly language on a minicomputer. 

The implementation executed in a 15-ms time frame which allowed real-time 
interaction with the control. Testing in a sea-level-static test stand 
compared idle to full-power step responses of rotor speed and thrust. For 
single failures, steady-state speed was held to within 1 percent of its 
final value and 92 percent of maximum thrust was achieved. For two sensor 
failures, steady-state speed was approximately 99 percent of its final 
unfailed value and thrust was 87 percent of maximum. Time to accelerate, 
however, had to be increased from 3 to 30 s. Failures were induced at 50 
percent power during a transient. Detection was reliable. The system also 
allows self-healing. An interesting feature of the DIA logic was its 
ability to learn, on line, all the data necessary to function. In a 
companion paper, Hrach et al.5 used a real-time nonlinear hybrid computer 
simulation of a two-spool turbofan, the TF30-P-3 engine, to demonstrate the 
DIA logic of Ref. 4 over a wide operating range. Four sensed variables: 
high-pressure rotor speed, high- and low-pressure compressor discharge 
static pressures, and nozzle total pressure; and five inputs: main fuel 

flow, nozzle area, afterburner fuel flow, and two compressor stage bleeds 


4 



were considered. Again hard failure detection and isolation were obtained 
by individual rate checks. 

Accommodation was achieved by replacement with averaged synthesized 
variables which were a function of the remaining good sensors <1, 2, or 3). 
Synthesized variables were obtained from tabulations. However, the data 
were now stored as corrected values to allow a wide operating range. Data 
for the tables were collected at two operating points. 

A real-time implementation of this DIA logic was programmed using 
assembly language in a minicomputer using a frame time of about 0.025 s. 
Storage requirements include 4K bytes for the logic and 0.2K bytes for the 
tables. The logic was tested at five selected operating points (which 
include the two design points). Acceptable operation with no limit 
violations and approximately the same thrust was obtained for operation with 
1 to 3 of the 4 sensors failed. For afterburning operating of the engine, 
acceptable control was possible for only a single failure and with a severe 
rate limit on accelerations. This logic also incorporated learning or 
adaptive logic. 

El 1 i s^ (January 1975) studied the use of AR techniques using a 
nonlinear digital simulation of a two-spool turbofan engine. The engine has 
five measured variables and two independent controlled variables. The DIA 
philosophy of this paper centers around estimates of the measured 
variables. First a multivariable linearized mapping (no explicit model 
dynamics) of corrected measurements to estimates is found. Since the engine 
has only two independent controls, it is assumed that only two measurements 
are required to generate an estimate. Taking unordered pairs of the five 
measured variables yields ten estimates of each measured variable. A 
weighted-average estimate is obtained by combining these ten component 
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estimates, each weighted by its relative accuracy. Detection and isolation 
are accomplished by a threshold check on both sides of each weighted average 
estimate. If a weighted estimate is outside of the threshold corridor then 
all weighting factors associated with this estimate are set to zero. 

Weighted estimates are used by the control at all times. Only the 
weightings change as failures occur. Thresholds for the weighted estimates 
are obtained from sensor error statistics assuming Gaussian distributions. 

The next contribution to this area is documented in four reports^-10 
by deSilva and Wells. This series of reports applies Bayesian hypothesis 
testing to the detection of engine sensor failures. The engine studied is a 
simple turbojet with two outputs, speed and thrust, and one input, fuel 
flow. A second-order pseudol inear model of the engine was used on a 
mainframe computer to evaluate detection performance. A pseudol inear model 
consists of a dynamical, linear state-space structure where individual 
coefficients within the linear structure vary as a nonlinear function of the 
state. Bayesian hypothesis testing is implemented by (1) defining a risk 
function, and (2) determining from measured data the hypothesis that 
minimizes this risk. This risk function defines the penalty associated with 
selecting a false hypothesis. Assuming Gaussian noise statistics, the 
lowest risk Bayesian hypothesis is also probabilistically most likely given 
the measured data. A "bank" of Kalman filters, one per hypothesis, uses 
measured data and an engine model to generate state estimates and filter 
residuals. The hypothesis associated with the most likely set of residuals, 
as determined by a likelihood ratio test, is taken as the true hypothesis. 
The mode of operation associated with this hypothesis (failed speed sensor, 
no failure, etc.) was assumed true. The approach worked well in simulation 
studies of this simple case. This work represents the first application of 


6 


analytical redundancy to turbine engines based upon modern control theory. 
Difficulties with this approach include the requirement of a different 
Kalman filter for each failure mode hypothesis. 

In June 1977 Spang and Corley 11 published an application of AR 
techniques to the quiet, clean, short-haul, experiment engine (QCSEE). This 
engine has seven measurements: fuel flow, compressor stator angle, fan 

speed, compressor speed, compressor discharge temperature and pressure, and 
turbine discharge temperature. Engine controls include fuel flow valve 
current and compressor stator vane blade torque motor current. In this 
study an extended Kalman filter approach is used to generate state estimates 
and residuals. A simplified nonlinear component model that is valid 
throughout the engine operating envelope and a simplified feedback gain 
matrix operating on engine measurements are used to update the filter 
estimates and residuals. Sensor failures were detected and isolated by a 
threshold comparison of the individual residual components. Thresholds are 
determined by sensor noise statistics. Only hard failures are considered. 

To accommodate failures, faulty measured values are replaced by sensor 
estimates from the filter. The approach was successfully demonstrated on a 
detailed, real-time, nonlinear hybrid computer simulation of the engine. 

The detection, accommodation, and control logic are implemented in a 
microprocessor-based control; also in real time. Successful operation for 
single hard sensor failures is demonstrated at sea-level-static conditions 
for power chops and bursts in the idle to full take-off power range. This 
work, referred to as Failure Indication and Corrective Action (FICA), serves 
as the theoretical foundation for a significant portion of the work in the 
application of AR to turbine engines. Further applications based on FICA 
are given in a subsequent section. 
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Next, DeHoff and Hall 12 report a largely theoretical study that 
developed a unified framework to achieve engine performance monitoring, 
trending, and sensor fault DIA. This framework is based upon 
maximum-likelihood state and parameter estimation methods. A simple 
turbojet example is used to illustrate the application of a 
maximum-likelihood-based, on-line, sequential-processing, parameter 
estimation algorithm to the detection of sensor failures. 

Sahgal and Miller 12 report on the design of a full-order observer that 
reconstructs fan turbine inlet temperature for an F100 engine. The observer 
is based upon a fifth-order scheduled state-space model with four inputs: 
fuel flow, nozzle area, and compressor and fan variable geometries; and four 
outputs: fan and compressor speed, and compressor discharge temperature and 

pressure. Observer performance is compared with a full nonlinear digital 
simulation of the engine at sea-level-static conditions. The reconstructed 
temperature tracks the actual temperature quite well. The analytical study 
proposes to use the reconstructed temperature to accommodate for fan turbine 
inlet sensor failures. 

The next three papers 14-16 by Leininger and Behbehani report the 
application of the generalized likelihood ratio (GLR) technique to the 
QCSEE. The GLR technique is a hypothesis-based test with the time and type 
of failure unknown. Under linear, Gaussian assumptions, if the Kalman-Bucy 
filter residuals are found to be nonwhite, a failure is declared. Next, 
various likelihood ratios are compared to determine the most probable 
failure time and type. The GLR method is used to detect and isolate hard 
and soft failures. Both single and multiple actuator and sensor failures 
were considered. 
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Detection and isolation studies are conducted by simplified simulation 
of the QCSEE. This simulation included six outputs: fan and compressor 

speeds, engine inlet static pressure, fan inlet duct static pressure, 
combustor pressure and compressor discharge pressure; and three inputs: 
fuel-metering valve position, fan nozzle actuator position, and fan pitch 
angle. A linearized, eight-state model was used in the Kalman-Bucy filter. 
Successful detection and isolation of multiple sensor and actuator failures 
with noisy sensors and imperfect modeling were demonstrated. Accommodation 
by control reconfiguration using nonsquare multivariable Nyquist array 
methods was proposed. Designs were obtained but not demonstrated by 
simulation. 

A doctoral dissertation by Meserole^ uses detection filter theory to 
design a filter that detects sensor failures in an F100 engine. Similar to 
the Kalman filter, the detection filter incorporates a dynamic process model 
and generates error residuals. However, unlike the Kalman filter, a 
detection filter is designed to respond to a component failure with a 
residual that has a fixed, usually unique, direction. Also, this direction 
is independent of failure mode. Thus, sensor failures can be detected and 
isolated by detecting the occurrence of these fixed-direction residuals. A 
sixth-order state-space linear model with scheduled coefficients is used in 
the detection filter. Filter operation and detection capability are 
demonstrated using a detailed nonlinear digital simulation of the F100 
engine. Fifteen components are checked for failure: the inlet pressure and 

temperature sensors, the fan and compressor speed sensors, the burner and 
augmentor total pressure sensors, the fan outer-diameter discharge and 
turbine inlet total temperature sensors, the fuel system, the nozzle, bleed, 
fan guide vane, and compressor stator vane actuators, and the high- and 
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low-pressure turbines. Five inputs are considered: fuel flow, nozzle area, 

fan guide vane and compressor stator vane positions, and bleed. Filter 
performance was studied for sensor failures and component changes (failures) 
at sea-level-static conditions for bias and scale-factor changes. Failures 
were detected for 2 to 5 percent changes in one or more output 
measurements. Minimum fai lure size for successful isolation is summarized 
by component in Table II. 

A paper by Leininger^ examines the impact of an inaccurate model on 
i nnovations-based detection and isolation procedures. The paper 
demonstrates that model inaccuracies appear as biases in the innovations 
(residuals). These biases are identified by a Student's "t" test. The "t" 
test is then related to a recursive GLR detector using a sequentially 
updated Kalman filter. Model bias error is removed from the innovations 
data to remove the effect of model degradation and to allow more accurate 
soft and hard failure detection. Also, a finite-width-window sequential "t" 
test is used to update the bias term and provide a means of sensor failure 
detection and isolation. The theory was applied to an eighth-order linear 
model of the QCSEE. Model eigenvalues were perturbed by 10 percent to 
simulate model error. The "t" test successfully removed the bias, tracked a 
sensor drift followed by a low-frequency sinusoidal sensor bias, and 
exhibited a fai 1 -heal -fai 1 detection pattern for the sinusoidal test. 

The next three papers present basic research in robust detection, 
isolation, and accommodation of sensor failures. This research focuses on 
one fundamental question: How accurately must engine dynamics be modeled 

for successful DIA? A definitive answer to this question would establish 
the quantitative tradeoffs between complexity, detection time, and detection 
performance. An alternative viewpoint would be to define the robustness of 
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a DIA algorithm to model inaccuracies or uncertainty. Two different 
approaches have been identified to the solution of this problem. 

The research of Refs. 19 and 20 is based upon the concept of 
redundancy, or parity, relations. These relationships among the measured 
system variables incorporate all possible redundant information available. 
Modeling uncertainty affects the reliability of these parity relations. For 
a quantified level of uncertainty, all parity relations can be ranked from 
most to least reliable. This allows the more reliable parity relations to 
be used to generate DIA strategies that are as robust to uncertainty as 
possible. A three-step design process is presented. First, the parity 
relations are rank-ordered using a robustness metric. That set of 
relationships with acceptable robustness is identified. Second, the 
coverage (probability of detection for all failures) for this set of 
relationships is assessed. Finally, the ability of the set of parity 
relations to distinguish each failure mode from the others is assessed, 
again using a metric-based analysis. Iterations through this process are 
possible in order to expand the original set of relationships and to improve 
coverage or di sti ngui shabi 1 i ty by incorporating decreasingly robust parity 
relations. The parity relations can be generated efficiently from either a 
time- or frequency-domain description of the average process. The average 
process is defined as 


A - E PfcA 
SU1 * 


% 


where A & represents the 8,th set of model parameters and pq, the a priori 
probability that Aq, is correct. The methodology has been applied to the 
preliminary design of a robust DIA system for an F100 engine. 


11 



The research of Ref. 21 is based upon the extension of recent advances 
in robust control system design to sensor DIA and estimator design. Model 
uncertainty effects on DIA robustness are quantified using conic sector 
uncertainty properties. Here, uncertainty that is bounded in a conic sector 
in the frequency domain, and which then propagates through a system, remains 
bounded by a conic sector. These sectors determine quantitatively the 
performance/robustness trade-off. This frequency-domain description of 
uncertainty along with frequency-shaped filter yields optimally robust 
innovations to model uncertainty. Thus, sensor failure detection based upon 
these innovations will also be robust. 

The design process makes use of a threshold selector. The threshold 
selector determines the minimum detectable failure size for a given noise 
level, failure type, false-alarm rate, and model uncertainty description. 
This threshold selector determines maximum achievable performance for the 
given set of constraints. Optimally robust (to modeling errors) residuals 
are generated using filters designed using the internal model principle and 
frequency shaping. The results of this methodology are applied to the 
preliminary design of sensor DIA logic for an F100 engine. 

Reference 22 presents an investigation of a variation of hardware 
redundancy to improve soft failure DIA capability. This feasibility study 
examines a multiengine approach (in this case two engines) to soft failure 
DIA. The underlying principle is to use a like sensor measurement from one 
engine as redundant information to improve DIA capability on another 
engine. This approach incorporates a model of potential engine differences, 
an average engine model, and decision logic. By looking at the sum and 
differences of redundant sensed values for the two engines, measured average 
and differential performance is obtainable. These are compared to the 
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average and difference engine models contained in the DIA logic. This 
additional information allows improved DIA performance over a single-engine 
concept. This concept is demonstrated using a digital nonlinear simulation 
of two F110 engines. 

The final paper in this section 23 determines the theoretical limits of 
failure detectability of sensor failures in systems with modeling errors. A 
method, called the reachable measurement intervals (RMI) method, is derived 
which is based upon this determination and which performs at the limit of 
detectability. This method is based upon a linear, state-space model of the 
system and bounds on the uncertainties of the model parameters. The RMI, 
which are the smallest possible thresholds, are computed using an 
optimization procedure based upon the maximum principle. Measurements which 
lie outside this interval indicate a failure. The method was applied to a 
hypothetical turbofan engine simplified simulation (HYTESS) 24 . High 
performance failure detection was demonstrated for a fan speed measurement 
at a single operating point, for small fuel perturbations. 

II. AR Technology Development 

Based upon the encouraging, but preliminary, results of the AR 
technology base, several technology development programs were begun. The 
overall objective of these programs is the full-scale engine demonstration 
of improved control system reliability using AR technology. These important 
AR development programs are: (1) Advanced Detection, Isolation, and 

Accommodation (ADIA), (2) Energy-Efficient Engine (E 3 ) FICA, (3) Full 
Authority Digital Electronic Control (FADEC) FICA, (4) Digital Electronic 
Engine Control (DEEC) sensor DIA, and (5) Analytical Redundancy Technology 
for Engine Reliability Improvement (ARTERI). Also included is a discussion 
of the sensor redundancy approach used on the PW2037 engine. 


13 


A. ADIA 




The objective of the ADIA program is to demonstrate a viable DIA 
concept based upon advanced methodologies. The ADIA program consists of 
four parts: development, implementation, real-time evaluation, and 

demonstration. 

The development of the ADIA algorithm is reported by Beattie et al .25,26 
Here advanced detection and filtering methodologies were compared to develop 
a viable ADIA concept. Comparisons were made on an F100 engine and F100 
multivariable control (MVC) 27 testbed system. The type and severity of 
sensor failures were carefully defined. Typical state-of-the-art 
transducers were selected. Failure characteristics were defined and 
quantified according to the predominant failure categories of out-of-range, 
drift, and noise. Next, a failure mode and effects analysis was conducted 
to classify the various failure modes as critical or noncritical. Critical 
failures were defined as those that resulted in surge, a 10 percent or 
larger thrust variation, or a rotor overspeed. This classification was 
accomplished over the full operating range of the F100 engine. Five 
competing DIA concepts were developed by combining available detection and 
filtering technologies. These five concepts were specifically formulated to 
span as many applicable technologies as possible. 

Since competing technologies were to be compared, a scoring system was 
developed. The scoring system evaluated the concepts for (1) exceeding 
minimum transient and steady-state operation requirements, (2) detection and 
isolation effectiveness, and (3) the qualitative benefits of bettering the 
requirements of item 1. Using the scoring system and a simplified 
simulation of the testbed system, the five concepts were screened. Two 
concepts were selected for a more detailed comparison. Based upon this 
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second screening, one concept was selected for evaluation on a detailed 
nonlinear simulation of the testbed system. This detailed evaluation 
included simulated sensor failures for both steady-state and transient 
operation throughout the entire engine operating range. This evaluation 
showed the ADIA approach to be (1) viable for gas turbine applications, and 
(2) more systematic and straightforward when compared to a parameter 
synthesis approach. 

An accurate model of the engine is required to achieve high performance 
failure detection. The ADIA algorithm uses a simplified simulation of the 
engine. Scheduled functions of engine performance define the steady-state 
portion of the simplified simulation. A scheduled state-space system forms 
the basis of the dynamic portion of the simplified simulation. In total, 
linear state-space models at 119 different operating points were used that 
uniformly span the entire flight envelope. Each individual element of the 
state-space matrices was corrected to reduce data scatter and then scheduled 
by a nonlinear polynomial of selected model output variables over the flight 
envelope. This approach yields a model with linear structure that maintains 
the essential nonlinearities of the engine. A complete description of this 
modeling technology, as applied to the development of a hypothetical turbofan 
engine simplified simulation (HYTESS), is given by Merrill et al.24 a 
comparison of the response of the simplified simulation with actual engine 
performance demonstrates the excellent estimation capability of the 
simplified simulation. The ADIA algorithm incorporates this simulation and 
Kalman filter logic to improve these estimates further (Fig. 2). 

The test-bed system with ADIA and MVC logic is shown in Fig. 3. The 
ADIA algorithm consists of three elements: (1) hard failure detection and 

isolation logic, (2) soft failure detection and isolation logic, and (3) an 
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accommodation filter. The algorithm detects two classes of sensor failures, 
hard and soft. Hard failures are out-of-range or large bias errors that 
occur instantaneously in the sensed values. Soft failures are small bias 
errors or drift errors that accumulate relatively slowly with time. 

The algorithm consists of an extended steady-state Kalman filter, 
called the accommodation filter, that generates sensor estimates and 
residuals based upon the previously described simplified engine simulation. 
These residuals are compared to thresholds for hard failure detection and 
isolation. Soft failure detection and isolation is accomplished using a 
bank of six Kalman filters (one for each sensor failure and one for the no 
failure case) and a likelihood ratio test of the five different filter 
residuals (Fig. 4). The likelihood ratio test calculates a weighted sum of 
squared residuals (WSSR) statistic for each of the six filters. This 
statistic represents the log of the likelihood of the particular residuals 
being true. Substracting the likelihoods of the five failure hypothesis 
filters from the normal mode likelihood yields likelihood ratios. The test 
then compares the maximum likelihood ratio, which represents the maximum 
likelihood of a particular sensor failure hypothesis being true to a 
threshold. The threshold is adaptive and expands during transients to 
account for high frequency modeling error. The adaptive threshold enables 
an 80 percent improvement in steady-state failure detection performance. 
After a failure is detected and isolated, the faulty information is removed 
from the accommodation filter by reconfiguration. Estimates of all sensor 
outputs are still produced, however, now they depend upon the set of 
unfailed measurements. The ADIA algorithm interfaces with the MVC algorithm 
in two ways. First, it supplies the linear quadratic regulator (LQR) with 
estimates of the engine outputs at all times. Second, it supplies the 
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integral control logic with actual sensed values in the normal mode. An 
individual sensed value is only replaced with an estimate when a failure 
occurs and is detected and isolated. 

The second part of the ADIA program is the real-time 
microprocessor-based implementation of the MVC and ADIA algorithms. DeLaat 
and Merr i 11^8 describe a preliminary implementation of two 5-MHz, Intel- 
8086-based microprocessors operating in a parallel-processing environment. 
The first computer contains a fixed-point, assembly language, real-time 
implementation of the MVC that had been implemented and evaluated 
previously .29 The second computer contains the detection and accommodation 
logic implemented in floating-point FORTRAN. Subsequent work has 
incorporated a third microprocessor into the implementation and replaced the 
8086-based microprocessors with 8 -MHz 80186-based mi croprocessors .30 In 
this third computer the five isolation filters are implemented, again using 
floating-point FORTRAN. 

The total control cycle time is 40 msec. Data are transferred between 
CPU's through dual-ported memory. Synchronization between CPU's is achieved 
through interrupts. The total memory requirement for the three CPU's is 54K 
bytes for the algorithm and 17K bytes for the real-time executive. In all 
cases the code and constants were about 65 percent and the data or variables 
about 35 percent of the total memory required. 

In the evaluation phase, 31 .32 an evaluation of algorithm performance 
was obtained using a real-time engine simulation running on a hybrid 
computer and microprocessor implementation described above. The objectives 
of the evaluation were: ( 1 ) validate the algorithm for sensor failure 

detection, isolation, and accommodation (DIA) effectiveness: (2) document 
algorithm performance; (3) validate the algorithm's real-time 


17 



implementation; and (4) establish a data base for the demonstration phase of 
the ADIA program. All these objectives were successfully accomplished. 

In the demonstration phase 33 the ADIA algorithm was tested on a full 
scale F100 engine in the Lewis Research Center altitude test facility. The 
engine test successfully demonstrated the predicted performance of the ADIA 
algorithm on realistic hardware over a wide range of engine operating 
conditions. These conditions include altitude, Mach number, and power 
variations. 

The criteria used to evaluate detection, isolation, and accommodation 
performance were: (1) minimum detectable bias values and drift rates, (2) 

elapsed time between sensor failure and detection, (3) steady-state 
performance degradation after failure accommodation, and (4) transient 
response of the engine to the filter and control reconfiguration resulting 
from failure accommodation. Although the engine test demonstrated the 
capability to detect, isolate, and accommodate both hard and soft sensor 
failures, only soft failure detection results are presented. This is 
because soft failure detection is more difficult than hard failure 
detection, and is therefore a more interesting problem. Two soft failure 
modes were studied, bias and drift. 

The minimum detectable magnitudes of soft sensor bias failures for 
engine exhaust nozzle pressure (a variable closely related to engine thrust) 
demonstrated during testing are summarized in Fig. 5. Also shown in this 
figure for comparison are those minimum detectable magnitudes predicted by 
the real-time hybrid evaluation of the ADIA algorithm. 32 In general there 
is good agreement between predicted and observed detection magnitudes. This 
agreement demonstrates the excellent fidelity of the model used in the 
algorithm and the simulation used in the evaluation. Many of the values are 
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the same. This is a result of the testing procedure. To minimize engine 
test time, the known evaluation predicted values were tested first. If the 
algorithm successfully detected the failure at the predicted magnitude, then 
that was the assumed minimum detectable value for the demonstration. If the 
detection was missed, the failure magnitude was increased until successful 
detection was demonstrated on the engine. Thus the demonstration values 
recorded in Fig. 5 are always equal or greater than the predicted ones 
(except for N2 and PT4 at 55 K/ 2.2). Although this was a conservative 
approach, it was clear from the test results that only minimal improvements 
over the predicted performance were possible at a limited number of 
operating points. 

The times to detection for the soft bias failures were all less than 
0.1 sec. The steady-state accommodation performance for this class of 
failure is shown in Fig. 6. Percent changes in engine pressure ratio (EPR) 

(EPR Tn - EPR T r ) 

AEPR = 100* L f 53 — 

tPK TQ 

EPR = Exhaust nozzle pressure/engine inlet pressure 
where EPR jq is the steady-state EPR before the failure and EPR jp is the 
steady-state EPR after the failure as shown for several operating points 
demonstrating subsonic and supersonic operation at military and medium power 
levels. Medium power is approximately half of military power. The 
parameter EPR is almost linearly related to engine thrust and is therefore a 
good measure of engine performance. All values are well below the 10 
percent critical level except for operating condition 50 K/1.8 results which 
show a 12 percent change in thrust for a PT6 sensor failure. This result is 
due to the low nominal value of PT6 at this condition (16.5 psi). The 
actual change in PT6 caused by the modeling error in the accommodation 
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filter is only 2 psi and is considered relatively small. It appears large 
when compared with the low nominal value. 

The minimum detectable drift magnitudes were determined by finding the 
smallest detectable drift failure such that a failure was detected 
approximately 5 sec after failure inception. Initial trial magnitudes were 
determined as before from predicted simulation values. The results are 
given in Fig. 7. Again shown in this figure for comparison are those 
minimum detectable magnitudes predicted by the real-time hybrid evaluation 
of the ADIA algorithm. As expected from the bias failure results, there is, 
in general, good agreement between predicted and observed detection 
magnitudes. Steady-state accommodation performance for subsonic and 
supersonic conditions at full and medium power for sensor drift failures was 
very good with most thrust changes being small and with none larger than the 
10 percent level . 

Additionally, detection performance for sequential failures was 
demonstrated. At condition 10 K/0.6 six different sequences of soft 
failures were injected into the test bed system at medium power and one 
sequence was demonstrated at intermediate power. One example of a failure 
sequence was to fail N1 , then 4 sec later fail N2, then PT4, and then PT6. 

In each case the algorithm successfully detected and accommodated each 
sensor failure in the correct order. Steady-state thrust changes are all 
close to the critical 10 percent level except for the intermediate power 
case. In each case these changes were experienced well into the transient 
when only two of the five sensors remained unfailed. These tests 
demonstrate the ability of the algorithm to continue to successfully perform 
even after most of the sensors have failed. 
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Finally, a simultaneous soft failure of PT4 and PT6 (both failed at the 
same instant of time) was injected into the engine system. The algorithm, 
although not designed for this extremely low probability event, successfully 
detected and accommodated this failure scenario. The change in EPR is about 
1.5 psi or less than 7 percent. 

All of the above failures were electronically generated using special 
purpose hardware to give timed and repeatable results. The generated 
failures represent realistic sensor failures which were injected into the 
engine control system. However, during engine testing an unplanned failure 
of actual sensor hardware was detected by the ADIA logic. Additionally, 
there were no missed detections of sensor hardware failures by the ADIA 
logic. The sensor hardware failure was associated with the FTIT 
measurement. About 13 sec after the start of a nozzle pressure sensor 
failure detection experiment, an FTIT soft failure was detected. From the 
sensed FTIT signal shown in Fig. 8(a) it is clear that some transient 
anomaly occurred. The likelihood ratio for FTIT given in Fig. 8(b) shows 
the detection taking place (note that the detection threshold for this case 
is twice the normal size) at 13 sec. The failure mode is indicative of a 
momentary "singing" of a signal conditioning amplifier. Although conclusive 
proof of a hardware failure was not obtained because of its 
nonrepeatability, this failure mode was not observed again once the 
suspected signal conditioning amplifier was replaced. 

Two experiments were used to demonstrate the successful accommodation, 
or post-failure performance, of sensor failures. The first experiment 
consisted of injecting, detecting, and accommodating a single sensor failure 
and then commanding an acceleration-deceleration pulse transient. Engine 
performance, measured on the average absolute value of control error over 
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the transient, with this accommodated failed sensor is compared to normal 
mode engine performance. Eighteen of these single failure pulse tests were 
performed at five different operating points. 

In general the change is performance is small for each experiment. The 
largest fan speed error change of about 160 rpm is, in fact, quite small 
when compared to the typical operating range of fan speed (5000 to 10 000 
rpm). Results for an engine acceleration-deceleration pulse response with a 
single exhaust nozzle pressure sensor failure and its baseline response are 
shown in Fig. 9. Results are shown for both fan speed and exhaust nozzle 
pressure. In general performance was good since the desired or request 
values were closely maintained. A slight drop in actual nozzle pressure can 
be seen but this is acceptable. In all other cases the accommodated single 
failure transient performance was good. The fluctuations evident in nozzle 
pressure at the high power level are caused by an airflow interaction 
between the altitude test cell and the engine. 

The second accommodation performance experiment demonstrated the 
excellent accuracy of the engine model. In this experiment all the engine 
output sensors were failed and accommodated. Then, the engine was commanded 
to respond to a PLA pulse transient. Two al 1-sensors-fai led pulse transient 
experiments were performed at different conditions. At the first condition 
(altitude 10 000 ft, Mach number = 0.6) the transient was from idle to about 
75 percent of full power. As confidence in the ability to safely control 
the engine without engine output sensors increased, a second test went to 
full power. For the first condition fan speed and exhaust nozzle pressure 
results are shown in Fig. 10. Here excellent performance was demonstrated. 
Little or no overshoot was observed and engine steady-state performance was 
good. This demonstrates the capability of safe, predictable engine 
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operation without any engine feedback information over a slightly restricted 
power range. Again the fluctuations in nozzle pressure at high power were 
caused by an airflow interaction between the facility and the engine. 
Performance for the second condition was similar. 

Based on the results of the engine test several conclusions have been 
reached. First, the ADIA failure detection algorithm works and works quite 
well. Sensor failure detection and accommodation were demonstrated at 
eleven different operating points which included subsonic and supersonic 
conditions and medium and high power operation. The minimum detectable 
failure magnitudes represent excellent algorithm performance and compare 
favorably to values predicted by simulation. Accommodation performance was 
excellent. Transient engine operation over the full power range with single 
sensors failed and accommodated was successfully demonstrated. Open loop 
engine operation (all sensors failed and accommodated) over at least 75 
percent of the power range was also demonstrated at two different operating 
condi tions . 

Second, the algorithm is implementable in a realistic environment and 
in an update interval consistent with stable engine operation. 

Off-the-shelf microprocessor based hardware and straightforward programming 
procedures, including FORTRAN and floating point arithmetic, were used. 
Parallel processing was also used and shown to be an effective approach to 
achieving a real-time implementation using off-the-shelf (cost effective) 
computer resources. 

B. E 3 FICA 

The program is developing technology to improve the energy 
efficiency of future commercial transport aircraft engines. A FADEC based 
upon the bit-slice AMD 2901 microprocessor is used to implement the control 
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and FICA logic for the engine developed under this program. The FICA logic 
Is based upon the concept of Spang and Corley. 11 Here, a sixth-order 
extended Kalman filter Is used to generate seven sensor estimates: fan and 

core speed, compressor Inlet and discharge temperatures , turbine discharge 
temperature, fuel-metering valve position, and compressor discharge static 
pressure. The Kalman filter uses a dynamic model of simplified engine 
aerothermodynamics and rotor dynamics. Actuator and sensor dynamic models 
are also Included. This model accurately describes the engine over the 
full-power range and flight envelope using simplified component modeling. 
The Kalman gain matrix is computed at a key operating point using a 
linearized engine model. Sensor failures are detected when the sensed 
versus estimated difference is greater than a prespecified tolerance. 
Out-of-range failures are also detected. The tolerance is estimated by 
statistical analysis and adjusted during simulation trials. Accommodation 
of failures is accomplished by replacement of sensed values with estimated 
values. A nonlinear real-time simulation evaluation of the FICA logic 
showed that the filter estimate tracked the sensed values within the 
specified tolerance and successfully detected, isolated, and accommodated 
all hard sensor failures except fuel-metering valve position. The E 3 FICA 
logic does not detect slow drift, i.e., soft, sensor failures. 

C. FADEC FICA 

Under the FADEC program 33 AR techniques (in particular, FICA) were 
applied to two engines, a Joint Technology Demonstrator Engine (JTDE) and 
the F404 afterburning turbofan engine. Each of these applications is 
discussed below. 

The JTDE FICA was designed for a variable-cycle engine with seven 
manipulated variables and nine sensed variables. The engine model used in 
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the JTDE FICA is a second-order, dynamic pseudol inear model valid throughout 
the flight envelope. The model is updated by an observer. Observer gains 
were chosen as the reciprocals of corresponding engine model steady-state 
gains at a high-power condition. Gains were then adjusted to achieve 
adequate stability margins. For failure detection, sensor model errors were 
compared to a preset threshold. Substitution of estimated variables was 
demonstrated using a simulation and, subsequently, a full-scale engine. The 
engine demonstration was limited to sea-level-static conditions and single 
substitutions. Single substitutions for fan speed, compressor discharge 
static pressure, and compressor inlet temperature were performed 
successfully. Also demonstrated by simulation in this program was the 
application of FICA techniques to actuator sensor failures. In particular, 
fuel flow and nozzle area actuator hard out-of-range sensor failures were 
detected and accommodated. 

A second application of the FICA technology was to the F404 engine. 

The F404 is an afterburning turbofan engine with a rear variable-area bypass 
injector to permit selective cycle rematch. The rear injector adjusts the 
bypass-to-core-air ratio to match cycle demands. The engine includes five 
inputs and five outputs. A simplified, fourth-order, component-level 
model 36 is used in the FICA system. The model is accurate throughout the 
flight envelope and was implemented in FADEC microprocessor hardware in a 
0.01-s update time increment. The model along with the FICA update logic 
was checked against actual engine operation during full-scale engine tests 
at sea-level-static and altitude conditions. 37 Steady-state and transient 
model accuracies were judged to be excellent. Single, double, and triple 
substitutions of FICA-generated estimates were performed successfully during 
the engine tests. These combinations are summarized in Fig. 11. Actuator 
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FICA was also demonstrated successfully for exhaust nozzle hard open and 
closed failures. Thrust level in these cases was maintained by adjusting 
the gas generator speed reference schedule. 

D. DEEC DIA 

The DEEC system 38 is a digital full-authority engine control containing 
selectively redundant components and fault-detection logic. The system also 
contains a hydromechanical backup control. Most of the sensors in the 
control are hardware-redundant. However, failures of the inlet static 
pressure (PS2), burner pressure (PB), and fan turbine inlet pressure (FTIT) 
are covered using a form of AR called parameter synthesis. 

In parameter synthesis an estimate of one measured variable is 
synthesized from an algebraic function of one or more different measured 
variables. This relationship is static, i.e., no explicit dynamics are 
included. If PS2 fails a range check, a synthesized PS2 is determined from 
PB, compressor speed, N2, and inlet total temperature, TT2. IF PB fails, a 
synthesized PB is calculated from inlet total pressure, PT2, N2, and TT2. 
Fault detection of PB failures is based upon a comparison of measured and 
synthesized values. A comparison tolerance of ±25 percent determines 
failures. This large tolerance precludes detection of soft failures. Both 
PS2 and PB failures are accommodated by substitution. 

There are two groups of FTIT sensors. This allows hardware 
redundancy. However, if both FTIT sensor groups fail a range check, 
synthesized FTIT is substituted into the control. Synthesized FTIT is a 
function of PB and PT2. 

The DEEC DIA logic was verified by closed-loop bench testing. 

Simulated sea-level and altitude engine transients were performed. Faults 
were intentionally produced to evaluate DIA effectiveness. Subsequent 
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sea-level and altitude full-scale engine tests uncovered no new problems 
with the DIA logic. A series of flight tests of an F15 aircraft with an 
F100 engine and DEEC control further demonstrated the DEEC Logic 39 . During 
the flight program, the DEEC DIA logic did not detect any false alarms and 
did not cause any reversions to backup hydromechanical control. Two sensor 
failures occurred during the flight program. One, inlet temperature, was 
covered by redundant hardware. The second, exhaust nozzle pressure, failed 
to a high scale sensor limit. Appropriate accommodation action was taken by 
the logic in each case. 

Neither of the two sensor failures encountered in the flight-test 
program demonstrated the AR-based logic of the DEEC DIA. In a subsequent 
flight test program 40 the objective was to induce selected hard sensor 
faults and evaluate the resulting actions of the control. The test program 
included both an extensive ground-thrust stand evaluation and a flight 
test. In flight failures were introduced at steady-state conditions and 
during throttle transients. Throttle transients were performed by inducing 
the failures before and during the throttle movement. The sensors failed 
during the flight test included the compressor inlet variable geometry 
sensor, PS2 , PB, and FTIT. Most failures were detected and accommodated. 
However, a recreation of a broken line (hard) PB failure went undetected. 
Pilot response to aircraft performance after accommodation was favorable. 

E. ARTERI 

ARTERI 41 is a program to develop AR techniques based upon FICA to the 
point where they may be employed in a full-scale engine development 
program. Both hard and soft failures must be covered over the full range of 
engine power and flight conditions. A component tracking module, which 
tunes the engine model to match the actual engine by updating engine model 
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dynamic states, inputs, outputs, and component performance parameters, is 
used to extend FICA to include a soft failure DIA capability. Nonlinear 
simulation results have demonstrated the ability of the logic to 
discriminate among sensor, and actuator hard and soft failures. 

The real-time implementation and demonstration of the ARTERI logic on 
an actual engine remain to be accomplished. Also, the component tracking 
filter adapts the engine model at a selected operating point. Its global 
capabilities need to be improved to allow soft failure detection during 
large excursions in power or operating condition. 

F. PW2037 

The PW2037 engine is a modern, high-bypass-ratio turbofan engine and is 
the first to incorporate a completely digital, full-authority electronic 
control system. 2 The control is engine-mounted and dual-channeled to meet 
reliability requirements. As part of the control's redundancy management 
strategy, a combination of hardware and software sensor redundancy is used 
to ensure engine operability whenever the capability is available. Dual 
hardware is used for seven sensors (two speeds, two pressures, two 
temperatures, and thrust lever angle). All of these sensors are covered by 
channel-to-channel comparisons, as well as software range and rate checks, 
to detect failures. In the case of the two engine speeds and the two 
pressures, sensor failures are further covered by comparisons to synthesized 
estimates. In the case of a dual-channel failure (both low-spool-speed 
sensors, for example), operation continues using the synthesized estimate of 
low spool speed. The two pressures and high spool speed are synthesized 
from low spool speed using a parameter synthesis method. Low spool speed is 
synthesized from high spool speed. 
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III. AR Technology Assessment 


From the preceding survey an assessment of the relative 
state-of-the-art of applied AR can be obtained. The results presented in 
the technology base, and summarized in Table I, demonstrate the feasibility 
of AR-based DIA. In particular, straightforward range or rate checks have 
provided successful detection of hard sensor failures. Further, advanced 
DIA approaches based upon advanced statistical decision theory and optimal 
filtering have demonstrated soft failure DIA feasibility. However, this 
soft failure DIA capability is obtained at the cost of increased 
computational complexity. This additional complexity consists of two 
parts: the filtering and decision-making logic, and a more accurate, and 

therefore more detailed, model. These results also demonstrate a tradeoff 
between ability to accurately detect and time to detect. Where hard 
failures can be detected almost instantly, soft failures are reliably 
detected only after some finite amount of time. This time to detect is a 
function of threshold level, which determines detection reliability, 
required model accuracy, and logic complexity. Usually for soft failures, 
more time is available before accumulated error is damaging. 

Further results presented in the technology development section 
demonstrate AR-based DIA capability for hard and soft sensor failures on 
full-scale engines over a wide range of power and flight conditions. 
State-of-the-art operational systems, such as the DEEC and the PW2037 
control, use only limited AR in combination with more extensive hardware 
redundancy. 

The work presented in this survey clearly emphasizes the fundamental 
importance of modeling in successful DIA. A model detailed enough for 
accurate DIA throughout the flight envelope is a significant technical 
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challenge. Expectantly, when faced with a difficult technical problem, 
different approaches are pursued. Three different modeling approaches have 
been used: (1) parameter synthesis, (2) pseudol inear, and (3) simplified 

component. Both the parameter synthesis and simplified component modeling 
approaches have been used in successful hard failure DIA on full-scale 
engines. The pseudol inear method has been demonstrated for both hard and 
soft failure DIA on a full-scale engine. Each approach has its own 
advantages and disadvantages. 

The parameter synthesis approach, which was used in the DEEC DIA and 
the PW2037 , is simple to understand and straightforward to implement. 

Explicit dynamics normally are not included. However, this simplicity 
implies a less accurate model. Also, the most accurate interrelationships 
between measured and synthesized variables can not be identified easily or 
systematically. Model modifications are made easily. 

The simplified component approach, which was used in the FADEC FICA, 
results in more accurate models than the parameter synthesis approach. 
Simplified component models are based upon detailed nonlinear engine 
simulations. Detail is selectively removed from the detailed simulation to 
maximize simplicity while maintaining accuracy. This process requires a 
great deal of judgment and is not straightforward or systematic. In 
addition, simplified model performance is not easily predicted. A 
simplified component model relates naturally to the physics of the actual 
engine and, therefore, is readily understandable. However, modification of 
a simplified component model is not straightforward since changes in 
component performance can unpredictable effect on model performance. 

The pseudolinear modeling method used in the ADIA algorithm, is a very 
organized, systematic approach. However, to achieve accuracy through a wide 
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range of conditions requires a large amount of stored data. The relationship 
of a pseudol inear model with engine physics is not as straightforward as for 
a simplified component model. However, steady-state and dynamic model 
performance can be separated and modified independently. Due to the linear 
structure of the model equations, analysis and performance prediction is 
much easier with a pseudol inear model than with parameter synthesis or 
simplified component models. In addition, the complexity/accuracy tradeoff 
is defined more clearly for a pseudolinear model. 

IV. Concluding Remarks 

This chapter has surveyed the technology base and technology 
applications for analytical redundancy (AR)-based sensor failure detection, 
isolation, and accommodation (DIA) strategies for gas turbine engines. 

Several observations and conclusions are made. Comparisons of PW2037 
technology with that of the F8 digital fly-by-wire program, or the approach 
used in the ADIA program with that proposed by Montgomery and Caglayan, 42 
show that engine AR technology often builds or expands upon technology 
developed for flight controls. Also, modeling is the key issue in the 
success of AR techniques. Three types of models are used. Each has its 
advantages and disadvantages and no clear preferred type emerges. Because 
of this strong dependence of performance on modeling accuracy, fundamental 
questions about detection performance and robustness have been posed and 
addressed in robust DIA programs. Finally, simulation or full-scale engine 
testing has conclusively shown the feasibility of AR-based DIA for hard and 
soft failures. 
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application study 

Meserole 17 

E100 nonlinear 
simulation 

PL 

Detection filter 

None 

Digital 

simulation 

SLS 

15 

Theoretical and 
application study 

Leininger 1 ® 

QCSEE simulation 

Linear 

“t" test 

None 

Oigi tal 

simulation 

SLS 

3 

Theoretical study of 
model uncertainty 

Weiss et al . 19 
and Pattipati 
et al. 20 

F100 linear 

Linear 

SPRT 

None 

Oigi tal 

simulation 

SLS 

5 

Theoretical study of 
model uncertainty 

Emami-Naei ni 
et al. 21 

F 1 00 linear 

Linear 

Hypothesis 

Frequency- 

weighted 

filter 

estimates 

Digi tal 

simul at ion 

SLS 

5 

Theoretical study of 
model uncertainty 

Brown et al . 22 

FI 10 nonlinear 

Linear 

Threshold 

checks 

Substitution 

Digi tal 

simulation 

SLS 

9 

Application to 
multiple engines 

Horak 23 

HYTESS 

Linear 

RMI 

None 

Digi tal 

simulation 

SLS 

1 



Key: PS = parameter synthesis, SC = simplified component, PL - pseudol i near , SLS = sea level static, SPRT = sequential probability ratio test. 

GLR = generalized likelihood ratio, and RMI = reachable measurement interval. 
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TABLE II. - MINIMUM FAILURE SIZE FOR A DETECTION 3 
FILTER DESIGNED FOR AN F100 ENGINE 


Isol ati on 

Minimum failure size, 
percent 

Engi ne 

state 

Steady 

Unsteady 

Output sensors 

2 

5 to 10 

Inlet sensors 

2 

5 to 10 

Fuel system, exhaust nozzle 

5 to 10 

10 to 20 

Compressor vanes, fan vanes 

10 to 30 

20 to 60 

Rotor efficiencies 

2 

5 to 10 


a 2to 5 percent change in one or more output 
measurements . 



FIGURE 1. - TRENDS IN CONTROL COMPLEXITY OF AIRCRAFT 
TURBINE ENGINES. 


original page p? 

OF POOR QUALITY 


10X10 5 



FIGURE 2. - A COMPARISON OF ACCOMMODATION FILTER ESTIMATES WITH 
ENGINE MEASUREMENTS FOR FIVE ENGINE OUTPUTS. DATA SHOW AN 
ACCELERATION AND DECELERATION FROM IDLE TO FULL POWER AT 
10 000 FT ALTITUDE AND MACH NUMBER OF 0.6. 
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\ZZ RECONFIGURA- 

TION INFORMATION 

FIGURE 3. - FIOO TEST-BED SYSTEM WITH ADIA ALGORITHM AND MVC CONTROL. 
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FIGURE 4. - SOFT FAILURE DETECTION AND ISOLATION LOGIC BLOCK DIAGRAM. 


t-t>orA£r 

OPERATING POINT, ALTITUDE (1000 FT)/MACH NUMBER/ 
PILOT'S REQUEST 

FIGURE 5. - MINIMUM DETECTABLE MAGNITUDES OF 
EXHAUST NOZZLE PRESSURE SENSOR, SOFT BIAS 
FAILURES AT 10 OPERATING POINTS (4 SUPER- 
SONIC, 6 SUBSONIC). 
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CHANGE IN ENGINE PRESSURE RATIO, AEPR, PERCENT 


ORIGINAL PAGE IS 
OF POOR QUALITY 



PT6 PT M N2 N1 FT IT 

SENSOR 



OPERATING POINT, ALTITUDE (1000 FT)/MACH NUMBER/ 
POWER LEVER ANGLE 


FIGURE 6. - STEADY-STATE ACCOMMODATION PERFORMANCE 
FOR SOFT BIAS SENSOR FAILURES. 


FIGURE 7. - MINIMUM DETECTABLE MAGNITUDES OF 
EXHAUST NOZZLE PRESSURE SENSOR SOFT DRIFT 
FAILURES AT 10 OPERATING POINTS (4 SUPER- 
SONIC, 6 SUBSONIC). 
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EXHAUST NOZZLE PRESSURE. PS! FAN SPEED, RPM 


10x10 3 




STEADY STATE & TRANSIENT 


SENSORS 

SINGLE 

CA II 1 ID CT 

DUAL FAILURES 

TRIPLE 

CA II 1 IDCC 


rAILUKt 

SLS 

SLS 

25K/1.0M 

35K/0.8M 

rrtlLUKtO 

25K/1.0M 

PS3 

o 

oooco 

ZOAA 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

NF 

o 

o 

A 

□ 

□ □ 

T56 

O 

o 

O 

□ 

□□ 

T25 

O 

o 

A 

□ 

□ □ 

NG 

O 

o 

A 

□ 

□ 

□ 

WFM 

O 

□ 





O 20% TO 100% TO 20% DRY THRUST 
□ 30% TO 100% TO 30% DRY THRUST 

O 30% TO MINIMUM A/B TO 30% DRY THRUST 
A 30% TO MAXIMUM A/B TO 30% DRY THRUST 

FIGURE 11. - FIRM FICA SENSOR SUBSTITUTION RESULTS. 
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